oh he did his work, embedded an obfuscated dll in gzip converted to a byte array, which then uses ReadProcessMemory and WriteProcessMemory from kernel32.dll.
I think it's pretty nice, wonder does claymore detect it some way.